EMC Documentum Content Server Multiple Vulnerabilities (ESA-2014-079)

high Nessus Plugin ID 77635

Language:

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The remote host is running a version of EMC Documentum Content Server that is affected by multiple vulnerabilities :

- An error exists in the 'ssl3_read_bytes' function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298)

- An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that could allow nonce disclosure via the 'FLUSH+RELOAD' cache side-channel attack. (CVE-2014-0076)

- A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks.
Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195)

- An error exists in the 'do_ssl3_write' function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198)

- An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client.
(CVE-2014-0221)

- An error exists in the processing of ChangeCipherSpec messages that allows the usage of weak keying material.
This permits simplified man-in-the-middle attacks to be done. (CVE-2014-0224)

- A remote code execution vulnerability exists due to improper authorization checks. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary code. (CVE-2014-4618)

- An information disclosure vulnerability exists due to a flaw in the Documentum Query Language (DQL) engine. A remote, authenticated attacker can exploit this vulnerability to conduct DQL injection attacks and read arbitrary data from the database. Note that this only affects Content Server installations running on Oracle Database. (CVE-2014-2520)

- An error exists in the 'dtls1_get_message_fragment' function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470)

- An information disclosure vulnerability exists due to improper authorization checks on certain RPC commands.
A remote, authenticated attacker can exploit this vulnerability to retrieve meta-data of unauthorized system objects. (CVE-2014-2521)

Solution

Apply the relevant patch referenced in the vendor advisory.

Plugin Details

Severity: High

ID: 77635

File Name: emc_documentum_content_server_ESA-2014-079.nasl

Version: 1.7

Type: local

Agent: windows

Family: Windows

Published: 9/11/2014

Updated: 11/25/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 7

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2014-4618

Vulnerability Information

CPE: cpe:/a:emc:documentum_content_server

Required KB Items: installed_sw/EMC Documentum Content Server

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/19/2014

Vulnerability Publication Date: 8/19/2014

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-5298, CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-2520, CVE-2014-2521, CVE-2014-3470, CVE-2014-4618

BID: 66363, 66801, 67193, 67898, 67899, 67900, 67901, 69273, 69274, 69276

CERT: 978508

Detections

Analytics